Text

Units 1 & 2, License Amendment Request to Incorporate Seismic Probabilistic Risk Assessment Into the 10 CFR 50.69 Categorization Process Response to Request for Additional Information (RAIs 3b-1, 8-1, & 9b-1)
	ML18116A487
Person / Time
Site:	Vogtle
Issue date:	04/26/2018
From:	Gayheart C; Southern Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	NL-18-0597
	Download: ML18116A487 (8)
	v • d • e

.t. Southern Nuclear APR 2 6 2018 Docket Nos.: 50-424 50-425 U.S. Nuclear Regulatory Commission ATIN: Document Control Desk Washington, D. C. 20555-0001 Cheryl A. Gayheart Regulatory Affairs Director Vogtle Electric Generating Plant-Units 1 &2 40 Inverness Celllet Par~ wa~

Post Office Box 1295 l:lirmingham. AL 352-12 205 992 53 16 tel 205 992 7601 fax cagayhca@southemco.com NL-18-0597 License Amendment Request to Incorporate Seismic Probabilistic Risk Assessment into the 1 0 CFR 50.69 Categorization Process Response to Request for Additional Information (RAis 3b-1. 8-1, & 9b-1)

Ladies and Gentlemen:

By letter dated June 22, 2017 (Agencywide Documents Access and Management System Accession No. ML17173A875) Southern Nuclear Operating Company, Inc. (SNC) submitted a License Amendment Request (LAR) for Vogtle Electric Generating Plant (VEGP), Units 1 and 2 and requested U.S. Nuclear Regulatory Commission (NRC) approval to use the Seismic Probabilistic Risk Assessment model in the existing 10 CFR 50.69 categorization process. By letter dated January 5, 2018, the NRC staff notified SNC that additional information is needed for the staff to complete their review. SNC provided responses to requests for additional information (RAis) 1, 2, 3, and 12 by letter dated February 6, 2018. By letter dated February 21, 2018, SNC responses to NRC RAI questions 4, 5, 6, 7, 8, 9,1 0, and 11. As noted in the NRC letter dated January 5, 2018, portions of these responses may also be used for the NRC review of the VEGP Systematic Risk-Informed Assessment of Debris Technical Report. By letter dated March 28, 2018, the NRC staff notified SNC that that further information was needed for the staff to finalize their review. The Enclosure provides the SNC response to the NRC requests for RAis, specifically, questions 3b-1, 8-1 and 9b-1.

This letter contains no NRC commitments. If you have any questions, please contact Jamie Coleman at 205.992.6611.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 2.(o day of April, 2018.

Cheryl~

Director, egulatory Affairs Southern Nuclear Operating Company CAG/PDB/SCM

U.S. Nuclear Regulatory Commission NL-18-0597 Page 2

Enclosure:

SNC Response to NRC Request for Additional Information cc:

Regional Administrator, Region II NRR Project Manager-Vogtle 1 & 2 Senior Resident Inspector-Vogtle 1 & 2 State of Georgia Environmental Protection Division RType: CVC700

Vogtle Electric Generating Plant-Units 1 &2 License Amendment Request to Incorporate Seismic Probabilistic Risk Assessment into the 10 CFR 50.69 Categorization Process Response to Request for Additional Information (RAis 3b-1, 8-1, & 9b-1)

Enclosure SNC Response to NRC Request for Additional Information

Enclosure to NL-18-0597 SNC Response to NRC Request for Additional Information (RAis)

NRC RA13b-1 In letter dated January 5, 2018, the NRC requested in RAI 3b that the licensee demonstrate how the limitations and conditions in the NRC staff's safety evaluation for PWROG-14001-P, Revision 1, "PRA Model for the Generation Ill Westinghouse Shut-Down Seal," (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17200C876) are being met. The licensee's response stated, in part, that the Limitation and Condition 2 (demonstration of seal operation subsequent to exceedance of a particular cold leg temperature) is addressed "probabilistically in the VEGP SPRA but did not provide supporting information. It is, therefore, not apparent how the licensee addressed Limitation and Condition 2 probabilistically. Furthermore, the licensee's response does not describe whether and how the VEGP SPRA addresses the impact of asymmetric reactor coolant system (RCS) cooling on seal operation.

i.

Please describe how the VEGP SPRA addresses Limitation and Condition 2 "probabilistically.

ii.

Please discuss how the VEGP SPRA addresses the impact of asymmetric RCS cooling on seal operation.

SNC Response to RAI 3b-1

i.

The Vogtle Electric Generating Plant (VEGP) Seismic Probabilistic Risk Assessment (SPRA)

Model incorporated shutdown seal operation subsequent to exceedance of a particular cold leg temperature using event tree/fault tree modeling. The modeling approach and basis is provided in the following paragraphs.

ii.

The success or failure of the shutdown seal operation is a top event on the loss of offsite power (LOSP) and station blackout (SBO) event trees. If Reactor Coolant Pump (RCP) seal cooling is lost (either through loss of thermal barrier cooling or loss of RCP seal injection), then success of the shutdown seals was defined as:

Correct actuation of all shutdown seals, AND Either:

o Successful auxiliary feedwater (AFW) flow to all four steam generators (SGs), OR o

Successful AFW flow to at least two SGs, with successful depressurization using the atmospheric relief valves (ARVs)

These criteria are based on PWROG-14001-P, Revision 1, "PRA Model for the Generation Ill Westinghouse Shut-Down Seal," (ADAMS Accession No. ML17200C876). An initial analysis, performed by Westinghouse for asymmetric cooling based on the most bounding case, concluded that the temperature in the idle loop cold leg, where the steam generator is not getting adequate feed flow, will eventually exceed the temperature limitation. The analysis did not evaluate the time when the idle loop cold leg would exceed the limitation, but instead concluded that if cooldown of the RCS via the secondary side was initiated before the SG in the idle loop dried out, the cold leg temperature in the idle E-1

Enclosure to NL-18-0597 SNC Response to NRC Request for Additional Information (RAis) loop will remain below the temperature limitation. The assumption for dry out time of the idle loop SG was 45 minutes.

Information from the Westinghouse analysis, which was not based on MAAP, was used in modeling the impact of asymmetric cooling in the revised VEGP SPRA model. Additional time was assumed, beyond the 45 minutes, to account for a) time for the water in the idle cold leg to heat up after the SG dried out; and b) time for the polymer ring in the RCP shutdown seal to heat up and lose its material properties.

Consequently, the revised SPRA model was based on the more realistic assumption that if the operator failed to initiate cooldown within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the RCP shutdown seal would fail.

Following actuation of the shutdown seals, if AFW is provided to all 4 SGs, then the RCS cold leg temperature in all loops will remain below the temperature at which it is assumed that the shutdown seals would no longer work. If AFW flow is not provided to all 4 SGs, then there is the potential for asymmetric cooling. As long as there is AFW flow to two SGs, and the operator depressurizes the SGs and RCS within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , then again, the RCS cold leg temperature will remain below the shutdown seal failure temperature in all loops.

The failure of the shutdown seals is modeled in the fault trees. The fault trees for LOSP sequences are different than for SBO sequences, because LOSP sequences could have a combination of AFW motor-driven pumps (AFW MOP) and the AFW turbine-driven pump (AFW TOP), while the SBO sequences would only have the AFW TOP potentially available.

The fault tree top logic for the SBO sequences, with failure defined as:

Failure of one or more shutdown seal to correctly actuate, OR Both:

o Failure of AFW TOP flow to one or more SGs AND o

Failure of AFW TOP flow to three or more SGs, OR failure of depressurization using the ARVs Note that the probability of failure for the operator failure to depressurize is from the internal events PRA. It is appropriately increased as the seismic acceleration level increases.

The logic for the LOSP sequences is similar but includes the potential for AFW flow from the AFW MOP trains.

In summary, standard event tree/fault tree modeling was used to incorporate the RCP shutdown seals into the SPRA. The potential for asymmetric cooling and high temperature failure of the seals is included in the logic model.

NRC RAIB-1 In RAI 8a, the NRC requested to justify how the required risk sensitivity study outlined in Section 8 of Nuclear Energy Institute (NEI) 00-04, "1 0 CFR 50.69 SSC [Structures, Systems, and Components]

Categorization Guideline," dated July 2005 (ADAMS Accession No. ML052910035), will be performed for categorization using the SPRA. In its response to RAI 8a, the licensee states that the risk sensitivity study is not intended to be mechanistic and is a test to determine that an adequate margin to risk acceptance guidelines exist. Furthermore, the response stated that no changes other than that the factor of three change in unreliability and unavailability for low safety significance (LSS) components is required, because the factor of three increase addresses "any failure mechanism" of the modeled component. The response to RAI 8b also states that the validity of modeling inputs would be maintained by periodic updates to the SPRA model.

E-2

Enclosure to NL-18-0597 SNC Response to NRC Request for Additional Information (RAis)

The responses to RAis 8a and 8b appear to justify keeping the seismic capacity of LSS components unchanged as part of the risk sensitivity study outlined in Section 8 of NEI 00-04. It appears that the proposed approach to performing the risk sensitivity study for categorization using the SPRA may not be sufficjent to ensure that an adequate margin to risk guidelines exist if seismic capacities are affected, specifically when components do not have associated random failures or seismic failures dominate the random failures.

Please describe how the risk sensitivity study approach addresses the potential impact on seismic capacities. Alternatively, please discuss why seismic capacities will not be affected by the categorization program such that changing the seismic capacity of LSS components as a part of the risk sensitivity study described in Section 8 of NEI 00-04 analysis would not be warranted.

SNC Response to RAIB-1 SNC proposes to keep the seismic capacity of LSS components as is for the risk sensitivity study outlined in Section 8 of NEI 00-04. This proposal is based on VEGP's programs and processes where there is reasonable confidence that the seismic capacities of LSS components would not be impacted by alternative treatment.

SNC has a program for monitoring degradation that could affect the seismic capacity of components at a periodic frequency. The identified degradation is corrected through the standard Condition Reporting and the Corrective Action Program. Should an identified degradation appear to challenge a SPRA modeling aspect, then an impact evaluation on the results of the SPRA would be performed to determine whether or not the original categorization remains valid. Thus, the monitoring program for SSCs ensures that potential degradation of the seismic capacity would be detected and addressed before significantly impacting the seismic risk.

SNC has implemented a rigorous configuration management program to maintain the configuration of SSCs in the plant. Unless an item, to be procured, is equivalent to an existing item (e.g., like-for-like replacement); an appropriate design change process is utilized to ensure that design requirements remain unchanged as required by the 1 0 CFR 50.69 rule. In addition, as stated in the 1 0 CFR 50.69 rule, RISC-3 SSCs must meet the following requirements: 1) Meet Fracture toughness requirements for Class 2 and 3 components and 2) RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions, including seismic conditions. The procurement activities are developed and implemented to meet the above requirements.

The current SNC design change process is being strengthened to formally require that an SPRA impact assessment is performed to determine if the change in risk is acceptable. For changes that could impact the seismic configuration, the SPRA impact assessment would require an analyst to determine a seismic capacity of the new sse. After the SPRA impact assessment is performed, a recommendation would be made based on the results and overall impact to plant risk. Depending on the results, the procurement could proceed or be revised, or the sse could be re-categorized for the SPRA.

In summary, based on the VEGP 50.69 program procedures, and the supporting plant procedures, there is reasonable confidence that the seismic capacities of LSS components would not be impacted such that the plant CDF or LEAF would be significantly affected. Thus, an inclusion of LSS components in a sensitivity study required by NEI section 8.0 is not warranted to evaluate seismic capacity.

E-3

Enclosure to NL-18-0597 SNC Response to NRC Request for Additional Information (RAis)

NRC RA19b-1 In RAI 9b, the NRC requested that the licensee describe how the SPRA importance measures will be used to calculate the integrated importance measures and justify any impact of the approach for calculating the SPRA importance measures on the integral assessment. The licensee's response stated that the formulae in NEI 00-04 for integrated importance measures will be used to "combine the seismic importance measures with the internal events and fire importance measures." It is not apparent from the licensee's response and the NEI 00-04 guidance how the integrated importance measures are calculated for certain SPRA basic events that may not align with basic events in other PRA models. Examples of such SPRA basic events include SPRA basic events that are specific to the SPRA model or SPRA basic events that represent a subcomponent modeled within the boundary of an internal events PRA component.

Please describe and justify how the integrated importance measures are calculated for SPRA basic events that may not align with basic events in other PRA models.

SNC Response to RAI 9b-1 The importance evaluations performed in accordance with the process in NEI 00-04 are determined on a component basis. It is not necessary that there be complete alignment among the basic events that are pertinent to a given component from one hazard PRAto another, i.e., there may be hazard-specific basic events whose importance contributions are captured within the component importance calculations for that hazard.

A large majority of SPRA basic events are directly aligned with the basic events in other PRA models, and are combined using the formulae in NEI 00-04. However, as noted in this RAI, there are a few SSCs in the SPRA that are not directly included in the other PRA models.

Subcomponents The importance of a subcomponent that was not directly modeled in other PRAs will be accounted for in the importance calculation for the component to which it is associated because it can be treated as another failure mode of that component. For example, the trip and throttle valve for the AFW pump is modeled in the internal events PRA, the fire PRA, and the seismic PRA. Seismic-induced relay chatter, a failure mechanism unique to the SPRA, could cause the valve to close, stopping the pump. In other PRAs, this relay was considered part of the valve boundary and its failures are inherently accounted for in the valve failure probability and associated component importance. For the SPRA, the relay was directly modeled to spuriously close the valve. The SPRA importance of the relay would be considered as a contributor to the valve failure and accounted for appropriately within the valve's importance measures for the integrated importance measures assessment, following the process in NEI 00-04.

The decision on the need to treat seismic basic events as representing subcomponents within the importance calculations for another modeled component will be made based on the modeling in each of the PRAs, as part of the PRA basic event-to-component mapping within the categorization process.

SSCs Not in Other PRA Models While most of the SSCs in the SPRA are directly aligned with SSCs in the other PRAs (internal events, internal flooding, fire), there are some SSCs that are unique to the SPRA. These SSCs may have been screened out of the other PRAs, following the PRA modeling requirements in the ASMEIANS PRA Standard, based on their having no credible failure mode (or an extremely low probability of failure}. If E-4

Enclosure to NL 0597 SNC Response to NRC Request for Additional Information (RAis) these SSCs are high safety significant (HSS) for the SPRA, then their integrated safety significance computation is not necessary. The safety significance would be presented to the Integrated Decision-making Panel (lOP) for their consideration in the decision-making process. The NEI 00-04 process allows the lOP to adjust significance of a seismic PRA modeled SSCs using proper justification. The quantitative integrated importance measure assessment is only one portion of the categorization process.

The following examples demonstrate how the SSCs that are only in the SPRA would be treated for the importance analysis. Some components only appear in the SPRA, because they do not have a credible failure mode in other PRAs, or have been screened for other reasons.

Structures are not directly included in the other VEGP PRA models because there is no credible failure mode, but some structures are included in the SPRA. If these structures are HSS in the SPRA, then their integrated safety significance computation is not necessary. The safety significance would be presented to the lOP for their consideration in the decision-making process. The NEI 00-04 process allows the lOP to adjust significance of a seismic PRA modeled SSCs using proper justification.

SPRA specific SSCs: Some components only appear in the SPRA, because they do not have a credible failure mode in other PRAs, or have been screened for other reasons. These components will be treated as separate components for the integral importance measure assessment. Examples are:

o DG exhaust silencers: These silencers were not modeled in other PRAs because they are passive, with no credible internal events failure mode. However, for the SPRA, their seismic anchorage failure could potentially fail the DG exhaust train, resulting in failure of the DGs. For 50.69 categorization, they would be considered as having the same importance as the DGs, and would be categorized as HSS based on their impact on DG function. The integral importance assessment would not change this categorization.

o Chilled water chillers: Chilled water is not required as a mitigating system for the VEGP PRA. However, seismic failure of the chiller anchorages could break the service water piping connections, resulting in a flood that could propagate to fail electrical equipment on the bottom floor. Based on the screening criteria of the internal flooding PRA, the chiller flooding scenarios were screened out as non-significant contributors and were not modeled in the internal flooding PRA. However, if the chillers are HSS for the SPRA, then their integrated safety ~ignificance computation is not necessary. The HSS result would be presented to the lOP for their consideration in the decision-making process.

The NEI 00-04 process allows the lOP to adjust significance of a seismic PRA modeled SSCs using proper justification.

In summary, most of the seismic basic event importance measures can be directly aligned with components in the other PRAs. Those seismic basic events that are not explicitly modeled in other PRAs, but function as subcomponents of components modeled in other PRAs, will have their seismic importance measures combined with the other PRA importance measures using the NEI 00-04 formulae for the integral assessment. For other seismic basic events that are not explicitly modeled in the IE or Fire PRA (such as structures, and SPRA unique components), an integrated safety significance computation is not necessary because the integrated significance computation is only performed if a sse modeled in fire or seismic PRA has an initial HSS ranking. The safety significance would be presented to the lOP for their consideration in the decision-making process. The NEI 00-04 process allows the lOP to adjust significance of a seismic PRA modeled SSCs using proper justification.

E-5